Fix: Prevent filesystem exposure when CONTAINERS=1

[nedlir]

This PR addresses a critical security vulnerability where enabling CONTAINERS=1 unintentionally exposed sensitive container filesystem endpoints (such as /export, /archive, and /logs) via GET requests, allowing arbitrary file reads and full filesystem exports from any container.

Changes made

• Added explicit deny rules in haproxy.cfg for /archive, /export, and /logs endpoints before the blanket CONTAINERS allow rule.
• Introduced granular environment variables (ALLOW_ARCHIVE, ALLOW_EXPORT, ALLOW_LOGS) to control these sensitive endpoints individually, defaulting to 0 in the Dockerfile.
• Added missing ALLOW_PAUSE=0 and ALLOW_UNPAUSE=0 definitions to the Dockerfile.
• Documented the new variables in README.md and clarified the behavior of CONTAINERS.
• Added explicit test cases in tests/test_service.py to verify that CONTAINERS=1 alone no longer exposes these endpoints and that enabling the specific flags correctly grants access.

This ensures that tools needing basic container listing do not inadvertently gain unauthorized filesystem and log access, while preserving backwards compatibility for safe endpoints.

fixes #182